CVE-2023-50168 is a high severity (CVSS 7.7) XML external entity flaw in PDF generation in Pega Platform, from 6.x through 8.8.4. Pega released hotfixes only for 8.8.3 and 8.8.4, and says it will not provide fixes for older versions. If you run anything older, plan an upgrade.
What's affected
- Pega Platform 6.x to 8.8.4, per the NVD description.
- Hotfixes: HFIX-B394 for 8.8.3 and HFIX-B91 for 8.8.4, according to the vendor remediation note. The vendor says these apply to releases in standard support.
- No hotfix and no local change steps for earlier releases. The vendor says it will not provide hotfixes on other prior versions.
- A restart is needed for the hotfix changes to apply.
- The vendor note lists the same 7.7 rating as the record, so the two sources agree on severity.
- KEV status: the record shows kev as false.
How to check if you're exposed
Find the platform version of every Pega environment in the Designer Studio about page. Anything from 6.x to 8.8.4 falls inside the stated range. For 8.8.3 and 8.8.4, check that the matching hotfix is installed. For anything older, the exposure remains until you upgrade.
We did not find a command line check for hotfix status. Use the Pega hotfix manager and the vendor note, and ask Pega support when in doubt.
What to do now
- List all Pega environments and their versions.
- Install HFIX-B394 on 8.8.3 and HFIX-B91 on 8.8.4, then restart as the vendor requires.
- For older releases, schedule an upgrade to a supported version. This is the only fix the vendor offers.
- Until then, limit who can trigger PDF generation and review what XML input those features accept.
- Check Pega support for any updated guidance, since the remediation notes are revised over time.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity references. An XML parser that resolves external entities can be told to read local files or reach internal addresses while it processes a document. When the parser sits inside a feature like PDF generation, input that looks harmless can make the server fetch things it should not.
The usual defence is to turn off external entity and DTD processing in the parser. The record does not give the exact mechanism inside Pega, only that it affects PDF generation. The unusual part of this advisory is the support policy: a very wide affected range with fixes for two releases only. That makes the version inventory the most useful step.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fix for Pega 8.7 or older?
Not as a hotfix. The vendor says it will not provide hotfixes on versions other than 8.8.3 and 8.8.4, so the path is to upgrade.
Does the hotfix need a restart?
Yes. The vendor remediation note says a restart is needed for the changes to apply.
Sources
- NVD record for CVE-2023-50168
- Pega security advisory A24 remediation note
Last reviewed: 19 October 2026.
